Our Lady Queen of Martyrs Primary School City of York Council Internal Audit Report 2017/18

Headteacher: D Sutherland Date Issued: 29/05/18 Status: Final Reference: 15691/008

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Tuesday 6th and Wednesday 7th March 2018 as part of the Internal Audit plan for Children, Education and Communities for 2017/18. Schools are audited in accordance with a detailed risk assessment.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to Governors, the Headteacher and management that procedures and controls in the areas listed below are working adequately and are well controlled.

The audit reviewed processes and transactions in the following areas:

- Governance and Financial Management
- System Reconciliation
- Banking Arrangements
- Contracts, Purchasing and Authorisation
- Income
- Capital and Property
- Extended Schools Provision
- Human Resources
- Payroll and Staff Costs
- School Meals
- Pupil Numbers
- School Fund
- Data Protection and Information technology
- Insurance and Risk Management
- Joint Use Facilities
- Inventories
- Safeguarding

Key Findings Overall procedures in many areas were good. Financial records were well maintained and procedures were in place to ensure accurate information is presented to Governors. At the time of the audit a significant budget deficit had been predicted for 2018/19 (81K), increasing further in future years. Options for addressing this deficit were presented and discussed at 15/1/18 Finance & Staffing Committee and plans have been developed for financial recovery. It was noted that the Budget Management Policy on the schools website had not been updated with the latest version. All policies on the website should be kept up to date.

A number of recommendations were made mainly in relation to compliance with Council policy and legislation. These covered maintenance of registers of interest and gifts & hospitality, debt management, contract management, procedures for staff absence, data protection procedures and checking of the school inventory.

**Overall Conclusions**

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Register of Interests

| Issue/Control Weakness | Risk | |------------------------|------| | The Register of Interests for Governors is incomplete and there is no register for staff with financial responsibility. | Members of the Governing Body and staff at the school may be in a position to influence the placing of contracts in which they have a personal interest and the school may be unable to fully account for purchasing decisions in the event of challenge. |

Findings

It was found that the declarations of business interest for the current year had not been completed by four members of the current Governing Body. Two of these were relatively new members who had joined since the last review of the register. Also the school did not maintain a register of business interests for staff with financial responsibility and who could influence purchasing decisions at the school.

Recommendation

The school should ensure the Register of Interests for Governors is complete. A register of business interests should be drawn up for all members of staff who can influence purchasing decisions. Both registers should be reviewed on an annual basis and updated promptly for any new members.

Agreed Action 1.1

The school will ensure the Register of Interests for Governors is completed. A register of business interests will be drawn up for all members of staff who can influence purchasing decisions. Both registers will be reviewed on an annual basis and updated promptly for any new members.

| Priority | 3 | |----------|---| | Responsible Officer | Senior Administrator | | Timescale | June 2018 |

## 2 Gifts and Hospitality

| Issue/Control Weakness | Risk | |------------------------|------| | There is currently no Gifts and Hospitality Register in place. | Gifts may have been received that could influence purchasing decisions and Governors and staff at the school may be vulnerable to allegations of improper conduct in relation to the acceptance of gifts and hospitality. |

### Findings

A Gifts and Hospitality Register has not been established in which details of any gifts or hospitality received can be recorded.

### Recommendation

A register should be introduced to record any gifts and hospitality received. The register should be signed off on an annual basis. Guidance should be provided to staff about what must be recorded and how to conduct themselves in relation to gifts and hospitality they may receive.

### Agreed Action 2.1

A register will be introduced to record any gifts and hospitality received. The register will be signed off on an annual basis. Guidance will be provided to staff about what must be recorded and how to conduct themselves in relation to gifts and hospitality they may receive.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Senior Administrator| June 18 | 3 Debt Management

| Issue/Control Weakness | Risk | |------------------------|------| | The school does not have a Debt Management Policy in place. | The school may not collect all income due. |

Findings

The school has a small number of dinner money debts from before the electronic income collection system was introduced, which it is actively chasing. The school also has a small number of nursery fees debtors. Currently there is no debt management policy setting out the process that the school will apply in relation to debts. Additionally the fees for nursery fees are currently charged 1/2 termly in arrears. The school should review this policy to prevent the build up of debtors.

Recommendation

The school should adopt a Debt Management Policy setting out the process for chasing debts to ensure a consistent approach is used. A policy is available on the schoolbus website. A review of the way nursery fees are charged should be undertaken to avoid the build up of debts.

Agreed Action 3.1

The school already has a policy on dinner money arrears although it hasn’t been published on the website and requires updating to reflect the introduction of the electronic income collection system (which should largely if not completely eradicate dinner debts). The school will adopt a Debt Management Policy for the main school to incorporate dinner debts. The school is planning to develop and adopt a separate policy specifically for the nursery, to include matters such as the required notice for withdrawing a child as well as non payment of fees. The school would prefer to keep the Nursery Policy separate from a Debt Management Policy so as to avoid confusion for nursery parents.

| Priority | 3 | |----------|---| | Responsible Officer | SBM | | Timescale | September 18 |

### 4 Contractors Insurance

| Issue/Control Weakness | Risk | |------------------------|------| | The school has employed contractors to work on the premises or to deliver services without checking and retaining evidence that they hold the mandatory £5m public liability insurance cover. | Liability for the contractor's actions may fall on the school. |

#### Findings

The school commissions works on a one off basis or as part of a service contract. A sample of these contracts was selected and conformation that the school held a copy of the contractor’s public liability insurance requested. It was found that these certificates were not held by the school.

#### Recommendation

Checks should be made to ensure that all contractors employed hold £5m public liability insurance cover. A copy of their insurance certificate should be taken and retained in school.

#### Agreed Action 4.1

Most of the school’s contractors come via DBE’s Total Property Management for School’s programme who perform public liability insurance checks on all contractors which they use. The school will ask DBE to confirm that their public liability insurance checks include checking that the limit is at least £5m. The school will also ensure that any contractors they approach directly hold the relevant insurance and retain their insurance certificates.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | SBM | Immediately |

## 5 Schedule of Contracts

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school has not fully completed a schedule of on-going contracts at the school for annual review. | The school may not be achieving value for money. |

### Findings

The compilation of a schedule of all contractual arrangements at the school is currently in progress but is not yet complete. This schedule should be used to evidence the regular review of contracts, and to provide assurance to Governors that the school is achieving value for money.

### Recommendation

The schedule of contracts should be progressed and presented to Governors on an annual basis to allow effective challenge.

### Agreed Action 5.1

The schedule of contracts will be progressed and presented to Governors on an annual basis to allow effective challenge.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 3 | SBM | September 18 |

### 6 Sickness Self Certification

| Issue/Control Weakness | Risk | |------------------------|------| | Self-certification forms are not completed for all instances of absence and staff absence is not formally monitored. | Failure to comply with the Council's Attendance Management Policy. |

#### Findings

For a sample of staff who had recently had a short period of sickness absence it was found that a self certification form had not been completed. Staff absence was not monitored to ensure absence trigger points are noted and discussed.

#### Recommendation

On the first day of their return to work, all members of staff must be asked to sign a copy of the Council's self-certification form for any period of absence which has not been covered by a doctor's certificate. Every period of absence should be followed up by a return to work interview with the line manager/supervisor, usually on the first day of the employee’s return to work and this should be evidenced on the certificate. A record should be maintained of staff absence so when trigger points are reached they are discussed with the staff involved.

#### Agreed Action 6.1

The recommendations will be implemented

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | SBM | September 18 |

### 7 Pre Employment Checks

| Issue/Control Weakness | Risk | |------------------------|------| | Insufficient evidence may be held on file to confirm that all pre-employment checks have been completed. | The school may be unable to demonstrate compliance with section 8 of the Asylum and Immigration Act 1996 which may result in fines of up to £10,000. |

### Findings

Personal files for a small sample of new staff were reviewed. In one case documents to confirm the right to work in the UK had not been copied and retained on file.

### Recommendation

Evidence used to confirm the right to work in the UK should be in accordance with Border Agency Guidance and copies of documents used retained on file.

### Agreed Action 7.1

The school will ensure that evidence of all the required pre-employment checks will be retained in employee files.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | SBM | Immediately |

## 8 Data Breach Policy

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The school does not currently have a Data Breach Policy in place. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA) and statutory requirements may be breached. |

### Findings

The school has not adopted a separate Data Breach Management Policy. Procedures should be in place to ensure personal data breaches are correctly identified, investigated and reported in order to minimise the impact of a breach and comply with ICO requirements.

### Recommendation

It is recommended that a Data Breach Policy is formally adopted and approved by the schools Governing Body or incorporated into a revised Data Protection Policy.

### Agreed Action 8.1

The model Data Breach Policy from Veritau will be formally adopted and approved by the schools Governing Body.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Headteacher | July 2018 |

## 9 Information Management

| Issue/Control Weakness | Risk | |------------------------|------| | There is currently no record of the destruction or archiving of information in accordance with the schools retention schedule. | Information is kept for longer than is required in Data Protection legislation. Information is destroyed without record. |

### Findings

The school does not currently have a record of sensitive or personal data disposed of or destroyed in accordance with the schools record management procedures.

### Recommendation

The school should maintain a record of the destruction of sensitive or personal information. The IRMS Toolkit for schools including a retention schedule and guidance on record keeping is available from the internet.

### Agreed Action 9.1

The school will start to maintain a record of the destruction of sensitive or personal information.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Senior Administrator | July 2018 | 10 Inventory

| Issue/Control Weakness | Risk | |------------------------|------| | The inventory record is not subject to an independent check by a member of staff who is not responsible for its maintenance. | Items which have been lost or misappropriated may not be identified and investigated. |

Findings

An inventory record is maintained by the school and assurance was given that the record is checked on an annual basis. However this check is carried out by the member of staff responsible for the maintenance of the record. The record of checks is not retained or signed by the officer completing the checks.

Recommendation

The inventory check should be completed by an officer independent of maintaining the inventory record and evidenced by retaining a copy of the verified inventory signed by the officer completing the check. A log of checks should be maintained. If a full check is not carried out (eg a targeted check is completed of the most vulnerable items, higher value items or particular equipment) it should be clear from this record which items have been checked.

Agreed Action 10.1

The recommendations will be implemented at the next inventory check.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | SMB | January 2019 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |---------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.